NVD security advisory
Security advisory for The Ortto plugin for WordPress
CVE-2026-113387
Full advisory details, affected packages, severity context, and original source.
Affected technology
The Ortto plugin for WordPressAffected product
Advisory overview
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.